The repository provides phpcheck-url for a site URL and phpcheck-server for environments with server access. It says no Node packages are required.
The CLI checks HTTP X-Powered-By and Server headers, sending HEAD first and using GET only after HTTP 405 or 501. It can also inspect a local PHP installation with php -v. Its exit codes are 0 for OK, 1 for VULNERABLE, 3 for UNKNOWN, and 2 for invalid arguments. JSON output includes patch_status values of ok, vulnerable, or unknown.
The project compares reported versions with embedded October 20, 2026 cutoffs for listed PHP branches. It does not send exploit requests, follow redirects, or inspect response bodies. Hidden or absent headers produce UNKNOWN. The repository does not establish that a target is patched or vulnerable: distribution backports can differ from upstream version strings, and OpenAI says the cutoffs should be checked against the official PHP security release when affected and fixed versions are published.